@tdk-landscape/tdk-cli-core 1.3.129 → 1.3.130
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,26 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
|
|
|
4
4
|
|
|
5
5
|
## Unreleased
|
|
6
6
|
|
|
7
|
+
## 1.3.130 (2026-10-08)
|
|
8
|
+
|
|
9
|
+
- Releases now come with a signed checksum list: `checksums.txt.sigstore.json` (keyless Sigstore signature from the release workflow) is attached next to the binaries in [tdk-cli-releases](https://github.com/tdk-landscape/tdk-cli-releases/releases) and to a release with the same tag here. How to verify is in [docs/security.md](docs/security.md#releases). The binaries themselves are not signed individually (#869, #840).
|
|
10
|
+
- `tdk resource` for a Python backend now writes `pytest==9.0.3` in the generated `pyproject.toml` (was 8.3.4, affected by GHSA-6w46-j5rx-g56g) (#867).
|
|
11
|
+
- Examples: bumped past open Dependabot alerts: puma 7.2.1 (Sinatra), NestJS 11.1.18, drizzle-orm 0.45.2 and pytest 9.0.3 (#867).
|
|
12
|
+
- Supply chain: every checked-in Dockerfile base image is pinned to a digest (#865).
|
|
13
|
+
- Tests: a property-based fuzz test for the `service.json` line-break guard runs on every pull request (#866).
|
|
14
|
+
- Docs: the README shows the OpenSSF Best Practices badge (#868).
|
|
15
|
+
|
|
16
|
+
## 1.3.129 (2026-10-08)
|
|
17
|
+
|
|
18
|
+
- Security policy: `SECURITY.md` now states acknowledgement, assessment, fix and disclosure timelines (#842).
|
|
19
|
+
- Dependencies: four vulnerable transitive JavaScript dependencies bumped in `bun.lock` and `cli/pnpm-lock.yaml` (shell-quote, smol-toml, source-map-js, ws), and the BYO fiber (v2.52.15) and starlette (1.x) examples moved past known advisories (#843, #844, #845).
|
|
20
|
+
- Supply chain: every GitHub Action is pinned to a commit SHA (#864).
|
|
21
|
+
- Docs: a guide for testing webhooks locally (#846).
|
|
22
|
+
|
|
23
|
+
## 1.3.128 (2026-10-08)
|
|
24
|
+
|
|
25
|
+
- Internal: the skills-sync workflow gets `contents: write` only on the job that pushes, not workflow-wide (#841). No change to the CLI.
|
|
26
|
+
|
|
7
27
|
## 1.3.127 (2026-10-08)
|
|
8
28
|
|
|
9
29
|
- Security hardening flagged by Socket (#826). The npm package no longer includes `ext/ide-components/code_executor/server.py`, a browser terminal that ran client-supplied commands through a shell. `tdk` and the Tilt engine never started it. The other IDE components are unchanged. `tdk doctor` now single-quotes the registry URL and container name it passes to `curl` and `docker logs`, so a value such as `$(...)` can no longer run a command.
|
package/README.md
CHANGED
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
[](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/examples-e2e.yml)
|
|
10
10
|
[](https://github.com/tdk-landscape/tdk-cli-core/security/code-scanning)
|
|
11
11
|
[](https://scorecard.dev/viewer/?uri=github.com/tdk-landscape/tdk-cli-core)
|
|
12
|
+
[](https://www.bestpractices.dev/projects/15310)
|
|
12
13
|
[](https://snyk.io/test/github/tdk-landscape/tdk-cli-core)
|
|
13
14
|
[](https://socket.dev/npm/package/@tdk-landscape/tdk-cli-core/overview)
|
|
14
15
|
[](LICENSE)
|
package/cli/package.json
CHANGED
|
@@ -36,7 +36,7 @@
|
|
|
36
36
|
# =============================================================================
|
|
37
37
|
# L1: OS BASE + RUNTIME ENVIRONMENT
|
|
38
38
|
# =============================================================================
|
|
39
|
-
FROM oven/bun:1.3.11-alpine AS l1_golden
|
|
39
|
+
FROM oven/bun:1.3.11-alpine@sha256:7ed9f74c326d1c260abe247ac423ccbf5ac92af62bb442d515d1f92f21e8ea9b AS l1_golden
|
|
40
40
|
|
|
41
41
|
LABEL layer="l1" description="OS base with runtime environment" maintainer="tdk-project"
|
|
42
42
|
|
|
@@ -148,7 +148,7 @@ WORKDIR /app
|
|
|
148
148
|
# =============================================================================
|
|
149
149
|
# L4-BACKEND-NODE: BACKEND PRODUCTION RUNTIME (NODE.JS - LIGHTWEIGHT!)
|
|
150
150
|
# =============================================================================
|
|
151
|
-
FROM node:22-alpine AS l4_backend_node
|
|
151
|
+
FROM node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 AS l4_backend_node
|
|
152
152
|
|
|
153
153
|
LABEL layer="l4-backend-node" description="Backend production runtime (Node.js - lightweight)" maintainer="tdk-project"
|
|
154
154
|
|
|
@@ -178,7 +178,7 @@ FROM l4_backend_bun AS l4_backend_golden
|
|
|
178
178
|
# =============================================================================
|
|
179
179
|
# L4-FRONTEND: FRONTEND PRODUCTION RUNTIME
|
|
180
180
|
# =============================================================================
|
|
181
|
-
FROM nginx:1.27-alpine AS l4_frontend_golden
|
|
181
|
+
FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS l4_frontend_golden
|
|
182
182
|
|
|
183
183
|
LABEL layer="l4-frontend" description="Frontend production runtime with Nginx" maintainer="tdk-project"
|
|
184
184
|
|
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
# documented `tilt trigger` command rather than depending on Tilt's
|
|
8
8
|
# undocumented internal HTTP API).
|
|
9
9
|
|
|
10
|
-
FROM oven/bun:1.3.11-alpine AS base
|
|
10
|
+
FROM oven/bun:1.3.11-alpine@sha256:7ed9f74c326d1c260abe247ac423ccbf5ac92af62bb442d515d1f92f21e8ea9b AS base
|
|
11
11
|
|
|
12
12
|
# Pin to the same Tilt version this workspace runs (v0.37.7) so `tilt trigger`
|
|
13
13
|
# talks the same protocol as the real daemon it's connecting to. Installed
|